AppInNo. 10/780,098 
Amendment dated December 20, 2007 
Reply to Office Action of September 20, 2007 
Docket No. BOC9-2003-0087 (458) 

REMARKS/ARGUMENTS 

These remarks are made in response to the Office Action of September 20, 2007 
(Office Action). As this response is timely filed within the 3-month shortened statutory 
period, no fee is believed due. However, the Examiner is expressly authorized to charge 
any deficiencies to Deposit Account No. 50-0951. 

Claims Rejections - 35 USC § 103 

In the Office Action. Claims 1-15 were rejected under 35 U.S.C. § 102(b) as being 
anticipated by or, in the alternative, under 35 USC 103(a) as obvious over U.S. Patent 
6,988,075 to Hacker, et al (hereinafter Hacker). 

Although Applicants respectfully disagree with the rejections, Applicants have 
amended the claims so as to expedite prosecution of the present application by 
emphasizing certain aspects of the invention. However, such amendments should not be 
interpreted as the surrender of any subject matter, and Applicants expressly reserve the 
right to present the original version of any of the amended claims in any future divisional 
or continuation applications from the present application. 

Applicants have amended the claims to further emphasize certain aspects of the 
invention. As discussed herein, the claim amendments are fully supported throughout the 
Specification. No new matter has been introduced by the claim amendments. 

Aspects of the Claims 

It may be helpful to reiterate certain aspects recited in the claims prior to 
addressing the cited references. One aspect of the invention, as typified by amended 
Claim 1, is a method of permitting controlled access to medical information of a patient. 

The method can include establishing a storage means for storing the medical 
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information of the patient; establishing a means for accessing the medical information by 
the patient or any other authorized user; and controlling an authorization and a scope of 
access to the medical information by the patient according to a role of a user accessing 
the medical information by modifying an access control list. The access control list lists 
all authorized users and their respective roles. See, e.g. 5 Specification, paragraphs [0008] 
and [0023]. 

The Claims Define Over The Prior Art 

The present invention allows a patient to authorize and limit access to his or her 
medical information on a per user basis based on the role of the user and an access 
control list. In contrast, Hacker limits authorization and access to broad categories (e.g., : 
doctors and pharmacies). For example, once the patient authorizes pharmacies, all 
pharmacies obtain access. Naturally, the scheme of the present invention is more 
discriminating and thus provides greater security. For example, as described in paragraph 
[0028] of the specification of the instant application, a patient can authorize a physician 
or physician's office. The physician or office can then assign office workers various roles 
that allow them to have limited access to see specific parts of the record. In other words, 
while Hacker limits access by the type of entity, the present invention limits access by the 
role of the individual user. 

Hacker teaches "compensation by researchers" who have been given anonymous 
access to a patient record (see col. 10, lines 44-46). It is not clear described who gets 
compensated. However, from the context of the disclosure, it appears that it is the service 
provider who stores and controls access to the patient records. In the present invention, 
however, the patient is the party to be compensated, not the service provider (see 
paragraph [0033]). In other words, Hacker provides a credit bureau type of relationship 
where the individuals do not benefit from those mining their data. The present invention, 
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in direct contrast, gives foil control as well as any financial benefits to the individual 
patient who owns the data. 

The present invention addresses an access scenario that Hacker does not. This is 
the case when a patient goes to the doctor and once in the office, the patient provides 
short term access to his or her records long enough to support the visit at which point the 
access times out. The scenario of how a data view is expired when the physician logs 
into another room/appointment is described in paragraph [0026] of the specification of 
the instant application. 

Further, the present invention teaches that each user would have their own ID and 
pin (see paragraphs [0019] and [0038]). In contrast, Hacker teaches that the patient has 
to give away his or her key in order to authorize access. The advantage for each user to 
have their own ID is that the system can track and notify the patient regarding who 
accessed the system, what was accessed and when, thereby further ensuring the security 
of the patient's medical information (see paragraph [0035]). It is noted that column 7, 
line 67, to column 8, line 3, of Hacker only discloses that the patient is provided with 
notification as to what information was released to emergency medical personnel, not 
information about all users who accessed the medical information. 

The present invention further teaches assignment of access to allow for another 
physician to cover a patient while the primary provider is unavailable (see paragraph 
[0027]). The physician and/or the patient could assign and or delete this limited access 
assignment 

Accordingly, it is believed that Hacker does not teach or suggest every feature 
recited in the amended claims and in the newly-presented claims. Applicants respectfully 
submit, therefore, that each of the claims, including the newly-presented claims, defines 
over Hacker. 
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CONCLUSION 

Applicants believe that this application is now in full condition for allowance, 
which action is respectfully requested. Applicants request that the Examiner call the 
undersigned if clarification is needed on any matter within this Amendment, or if the 
Examiner believes a telephone interview would expedite the prosecution of the subject 
application to completion. 



Date: December 20, 2007 



Respectfully submitted, 



AKERMAN SENTERFITT 




Gregory A. Nelson, Registration No. 30,577 

Richard A. Hinson, Registration No. 47,652 

Yonghong Chen, Registration No. 56,150 

Customer No. 40987 

Post Office Box 3 188 

West Palm Beach, FL 33402-3 1 88 

Telephone: (561)653-5000 
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